Print Byline Authorization with airSlate SignNow

Print byline authorization

in this module we'll be talking about task m6 ongoing authorization so in this task we review the security and privacy posture of the system on an ongoing basis to determine whether the risk remains acceptable potential inputs for this task are risk tolerance security and privacy posture reports the plan of action and milestones the organization and system level risk assessment results and security and privacy plans the expected outputs for this task include a determination of risk ongoing authorization to operate ongoing authorization use or ongoing common control authorization we could also get a denial of ongoing authorization to operate a denial of ongoing authorization to use or a denial of ongoing common control authorization that's the bad thing we don't want to get primary responsibility like we saw earlier when we saw the earlier acceptance of risk this is acceptance of risk again and it's the responsibility only of the authorizing official supporting roles for this task are the senior accountable official for risk management the risk executive function the chief information officer the senior agency information security officer the senior agency official for privacy and the authorizing officials designated this does align with the sdlc it aligns with the new system operations and maintenance and guess what the existing system operations and maintenance does not align with the cyber security framework so let's jump into the task to employ ongoing authorization approach organizations have in place an organization level and system level continuous monitoring process to assess the implemented controls on an ongoing basis the findings or results from the continuous monitoring process provide useful information to authorizing officials to support near-real-time risk-based decision-making so all of the stuff we've done uh up to this point we have those frequencies when we assess the controls we have the reporting format in place we're keeping track of the system just like we should we're keeping track of changes in the system we know the current status as required of the process process processes that provide the security and privacy controls we are at a point where we can have this ongoing authorization which is really one of the benefits of the rmf in accordance with guidance in task r4 the authorizing official or designated representative reviews the security and privacy posture of the system including the effectiveness of the implemented controls on an ongoing basis to determine the current risk to the organizational operations and assets individuals other organizations and the nation and again we're just looking at this thing and we're going to make a determination if the system is in within the risk tolerances of the organization and can we keep using it or does it create unnecessary risk to the organization that would mean we have to stop using the system or the common control set the authorizing official determines whether the current risk is acceptable and provides appropriate direction to the system owner or common control provider the authorization the authorizing official may determine that the risk remains at an acceptable level for continued operation or that the risk is no longer accessible or that the risk is no longer accessible or the risk is no longer at an acceptable level for continued operation and may issue a denial about a denial of authorization to operate authorization to use or common control authorization essentially meaning that the system or common control set can no longer be used until it's brought back in aligned with the organizational risk requirements the risk may change based on the information provided by the security and privacy posture reports because the reports may indicate changes to the security or privacy risk factors that's why we provide those reports to organizational officials so they continue to make these risk-based decisions so at this point the authorizing official can determine to continue operating the system or they can deny the authorization to operate the system determining how changing conditions affect organizational and individual risk is essential for managing privacy risk and maintaining adequate security so you have to keep track of the change in conditions that we've talked about that we've talked about up to this point by carrying out the ongoing risk determination and risk acceptance the authorizing officials can maintain system and common control authorizations over time and transition to ongoing authorization reauthorization actions occur only in accordance with federal or organizational policies so if we have this continuous monitoring and we have ongoing authorization we don't have to have a period where we continue to go through the full reauthorization process we can just extend the current authorization for essentially as long as the system is within compliance with risk requirements the authorizing official conveys updated risk determination and acceptance results to the senior accountable official for risk management or the risk executive function we just want to keep the risk folks informed on if the system is going to continue to operate or if it's getting denial of course nist is going to point out the use of automated support tools to capture organize quantify and visually display and maintain the security and privacy posture information promotes near real-time risk management regarding the posture of the organization in regards to risk the use of metrics and dashboards increased the organization's capability to make risk-based decisions by consolidating data in an automated fashion and providing the data to decision makers at different levels within an organization in an easy to understand format dashboards are great metrics are great this is going to give boiled down information to the decision makers so they can make quick decisions in an easy to understand format so references for this task include nist special publications 830 39 55 160 volume 1 as well as ir8011 volume 1 and ir 8062 in this module we discussed task m6 its inputs outputs roles and responsibility sdlc and csf life cycle alignment ongoing authorization current risk risk acceptance changing conditions ongoing risk determination ao risk determination notification automation metrics and references if any of this does look familiar to you go back and watch those portions of the video you need to if it all makes sense on to the next video which is the last task in this step and the last task in the rmf if you're taking the course jump into the course material for further understanding of this topic